CVE-2023-3314: OS Command Injection
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-3314?
CVE-2023-3314 is a vulnerability that arises from the failure to properly sanitize the processing of zip files, allowing an authorized user to execute arbitrary commands.
What is the severity of CVE-2023-3314?
CVE-2023-3314 has a severity rating of 8.8, which is considered high.
Which software is affected by CVE-2023-3314?
Trellix Enterprise Security Manager version 11.6.7 is affected by CVE-2023-3314.
How can an attacker exploit CVE-2023-3314?
An attacker can exploit CVE-2023-3314 by using a specially crafted zip file to execute arbitrary commands.
Is there a fix for CVE-2023-3314?
Yes, it is recommended to update Trellix Enterprise Security Manager to a version that properly sanitizes zip file processing to mitigate CVE-2023-3314.